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DETAILED ACTION 

Response to Arguments 

1 . This office action is in response to applicant's response filed on 
02/12/2008. 

2. Claims 1-12 have been considered. 

3. Examiner withdraws rejection of claims 1, 6 and 9 under 35 U.S.C 112- 
first paragraph due to correction by the applicant. 

4. Claims 1 , 6 and 9 are amended. 

5. Applicant's arguments are persuasive in the light of Examiner Amendment 
above. Therefore the rejections of claims have been withdrawn. 

Allowable Subject Matter 

1. Claims 1-12 are allowed. 

2. The following is an examiner's statement of reasons for allowance: 

The primary reasons for the allowance of the independent claims 1 , 6 and 
9 are the inclusion of the following limitations that are not found in the prior art 
and they are uniquely distinct features. The closest prior arts are Trostle, US 
Patent No.: 6,775,783. Trostle discloses a method, a system and apparatus for 
limiting access by a user to a networked application or service is described. In 
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particular, access to network security credentials that allow a user to authenticate 
to application servers is more effectively controlled. This is accomplished by 
storing the user's credentials in memory that is only accessible by a local security 
authority (LSA). The host 202 (see fig. 1) also includes a logon program 208 
which can be invoked by one or more users to initiate one or more corresponding 
logon processes LP-1 through LP-n. The logon processes LP-1 through LP-n 
operate interactively with the corresponding users to facilitate logon of the user to 
the host 202. The host 202 can also include an application service or client 210 
and related security library 212. For example, the application client 210 can be a 
web browser or a directory browser. The network 204 is connected, via a 
transmission medium 206, to an application server 216 which is configured to act 
in response to requests from the application client 210 under certain conditions. 
Of course, host 202 can also include one or more other application clients (not 
shown) which can make requests to other application servers (not shown) 
connected to the network 204. In particular, the logon program can interactively 
prompt the user for the user identification information. In a specific example, the 
logon program then passes the user information via an inter process 
communication (IPC) channel to the LSA. 

The request of operation 402 (see, fig. 3) can include one or more aspects 
of the user information, for example, the user's user id and/or uid. Alternatively, 
the security library can acquire the user information by calling the system 
operating system (OS). In operation 404, the security library retrieves a secret 
from the secret file (described in FIG. 2), that corresponds to the present user. 
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This retrieval is accomplished by correlating the user information received by the 
security library, with characteristics of the file that identify it as corresponding to 
the present user. For example, the security library can look for a file having a 
known common component and having another component that matches the 
user id acquired by the security library in operation 402. The secret retrieved in 
operation 404 is passed to the LSA (local security authority) in operation 406 by 
the security library. The security library can pass the secret through an inter 
process communication (IPC) channel, which can be opened, for example, by the 
security library before or as part of operation 404. In operation 408 the LSA 
identifies the credential to which the secret corresponds, according to the 
formation of the secret by the LSA in operation 308 of FIG. 2. The LSA then 
passes a credential identifier to the application client, via the security library, in 
operation 410. This credential identifier can be a handle or any other suitable 
type of information that the application client, through the security library, can 
later pass to the LSA and thereby facilitate identification of the appropriate 
credential by the LSA. In operation 418, the LSA passes the authentication 
information to the security library. For example, in the example where the 
authentication information is a Kerberos ticket, the LSA can format and send to 
the security library a Generic Security Service Application Program Interface 
(GSSAPI) Kerberos initialize security context token (KISCT) containing the 
service ticket and an authenticator. In addition, the LSA can maintain a copy of 
the authentication information. In operation 420 the security library passes the 
authentication information received in operation 418, to the application client. In 
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subsequent operations, the application client can use the authentication 
information passed by the security library in operation 420, to attempt access to 
the related application server (i.e., authenticate the application client to the 
application server), and to thereby fulfill the user's invocation of the application 
client. Such subsequent operations by the application client and application 
server are well known to those skilled in the art. Operations 412 through 420 can 
be performed again to reestablish a security context with the same network 
service, or to establish a security context with a different network service. In fig. 
4, a process diagram of a method 500 for limiting access to a networked 
application, according to an embodiment of the present invention. In operation 
502 of method 500, a security library retrieves a secret from a file. The security 
library may perform operation 502 in response to a request from an application 
client that has been invoked by a present user. Such a request can be either 
directly or indirectly associated with initializing a security context for the 
application client. The file, or secret file, from which the secret is retrieved in 
operation 502 corresponds to and is readable and writeable by only the present 
user. Operation 504 includes the security library passing the secret to an LSA. 
The LSA uses the secret passed in operation 504 to identify, in operation 506, a 
credential located in memory associated with the LSA processes. The LSA 
identifies the credential based on a predefined one-to-one correspondence with 
the secret. 



However, this art, fail to anticipate or render the following limitation: 
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"Claims 1 , 6 and 9: a computer system that effects secure access to a 
store, comprising: receiving a request to access a store from a first process 
initiated by a requester; initiating a second process responsive to said store 
access request, wherein data generated by said second process is accessible to 
said first process but inaccessible to the requester; changing a context of said 
second process to the user id of said store; 

providing said store with an exclusive user id, said exclusive user id being 
different from a user id of the requestor; 

said second process receiving tokenized credentials corresponding to the 
user id and password of the requestor from said first process responsive to said 
request without the use of files and without interaction with said requester; 

said second process converting the tokenized credentials to the user id 
and password of the requestor and performing a lookup of said user id and 
password of the requestor in a credential store; 

said second process passing a user id and password associated with said 
store to said first process if said user id and password of the requestor are found 
in said credential store; 

communicating between said first process and said store via inter-process 
pipes; and 
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said first process obtaining data from said store via said inter-process 
pipes responsive to said store access request using said user id and password 
associated with said store." 

Any comments considered necessary by applicant must be submitted no 
later than the payment of the issue fee and, to avoid processing delays, should 
preferably accompany the issue fee. Such submissions should be clearly labeled 
"Comments on Statement of Reasons for Allowance." 

Conclusion 

Any inquiry concerning this communication or earlier communications from 
the examiner should be directed to YONAS BAYOU whose telephone number is 
(571)272-7610. The examiner can normally be reached on m-f,7:30-5:00. 

If attempts to reach the examiner by telephone are unsuccessful, the 
examiner's supervisor, Kambiz Zand can be reached on 571-272-381 1 . The fax 
phone number for the organization where this application or proceeding is 
assigned is 571-273-8300. 
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Information regarding the status of an application may be obtained from 
the Patent Application Information Retrieval (PAIR) system. Status information 
for published applications may be obtained from either Private PAIR or Public 
PAIR. Status information for unpublished applications is available through 
Private PAIR only. For more information about the PAIR system, see http://pair- 
direct.uspto.gov. Should you have questions on access to the Private PAIR 
system, contact the Electronic Business Center (EBC) at 866-217-9197 (toll- 
free). If you would like assistance from a USPTO Customer Service 
Representative or access to the automated information system, call 800-786- 
9199 (IN USA OR CANADA) or 571-272-1000. 

/Yonas Bayou/ 

Examiner, Art Unit 2134 

03/21/2008 

/Kambiz Zand/ 

Supervisory Patent Examiner, Art Unit 2134 



